TEA5767 radio FM module

I have attached logic analyzer to the I2C? bus (pins described abowe). Without HDD connected (so firmware hangs on IDE access) the only communication on the bus is 0x34 0x0A 0x00 which looks like some command for DAC. I have partialy confirmed this by entering "Diagnostic mode" - no I2C? communication, than selecting DAC test we see very the same sequence of bytes. According to WM8750 datasheet it means to unmute DAC which makes sense.

Diagnostic mode

You can put player in sort of diagnostic mode by pressing both rec and play buttons at startup. There You can choose to test DAC, USB connection, DRAM, LCD and keys (ADC). Particulary interesting is the keys (ADC) test which gives some informations how buttons are hooked. Buttons change reading from ADC2 (it is second channel of scf5249 adc). Play button seems to have the highest priority but it also ends the test so the value it produces is unknown. Other keys priority are in order: rec>vol down>vol up>next>prev>select the readings are: 340>680>1060>1410>1750>2100. Untouched buttons gives reading about 2800. This is very similar to the Iriver H1xx.

Moreover ADC1 and ADC4 seems to be related to headphone plug detection. When headphones are plugged reading from ADC1 and ADC4 is 000/2880 when jack is unplugged readings are 2900/0252. Looking through the firmware disasm ADC1 is related to the remote.

ADC3 is related to battery voltage reading. In original firmware value from ADC3 is readed 20 times and mean value of the 10 highest readings is indicator of the battery condition.